Shopify API access scopes

After you'vegenerated API credentials, your app needs tobe authorized to access store data.

Authorization is the process of giving permissions to apps. Users can authorize Shopify apps to access data in a store. For example, an app might be authorized to access orders and product data in a store.

An app can request authenticated or unauthenticated access scopes.

Your app can request the following authenticated access scopes:

Follow the procedures below to request specific permissions to request access scopes in the Partner Dashboard.

By default, you have access to the last 60 days' worth of orders for a store. To access all the orders, you need to request access to theread_all_ordersscope from the user:

1. From the Partner Dashboard, go toApps.
2. Click the name of your app.
3. ClickApp setup.
4. In theOrderssection, on theRead all orderscard, clickRequest access.
5. On theOrderspage that opens, describe your app and why you’re applying for access.

6. ClickRequest access.

   If Shopify approves your request, then you can add theread_all_ordersscope to your app along withread_ordersorwrite_orders.

Subscription apps let users sell subscription products that generate multiple orders on a specific billing frequency.

With subscription products, the app user isn't required to get customer approval for each subsequent order after the initial subscription purchase. As a result, your app needs to request the required protected access scopes to use Subscription APIs from the app user:

1. From the Partner Dashboard, go toApps.
2. Click the name of your app.
3. ClickApp setup.
4. In theSubscriptionssection, on theAccess Subscriptions APIscard, clickRequest access.
5. On theSubscriptionspage that opens, describe why you’re applying for access.
6. ClickRequest access.

If Shopify approves your request, then you can add theread_customer_payment_methodsandwrite_own_subscription_contractsscopes to your app.

By default, apps don't have access to any protected customer data. To access protected customer data, you must meet ourprotected customer data requirements. You can add the relevant scopes to your app, but the API won't return data from non-development stores until your app is configured and approved for protected customer data use.

Unauthenticated access scopes provide apps with read-only access to theStorefront API. Unauthenticated access is intended for interacting with a store on behalf of a customer. For example, an app might need to do one or more of following tasks:

• Read products and collections
• 创建客户和更新客户帐户
• Query international prices for products and orders
• Interact with a cart during a customer's session
• Initiate a checkout

To request unauthenticated access scopes for an app, select them when yougenerate API credentialsorchange granted access scopes.

To request access scopes or permissions for the Headless channel, refer tomanaging the Headless channel.

Your can request the following unauthenticated access scopes:

客户access scopes provide apps with read and write access to the客户Account API. Customer access is intended for interacting with data that belongs to a customer. For example, an app might need to do one or more of following tasks:

• Read customers orders
• Update customer accounts
• Create and update customer addresses
• Read shop, customer or order metafields

To request access scopes or permissions for the Headless or Hydrogen channel, refer tomanaging permissions.

Your can request the following customer access scopes:

You can check your app’s granted access scopes using theGraphQL Admin APIorREST Admin API.

• Apps should request only the minimum amount of data that's necessary for an app to function when using a Shopify API. Shopify restricts access to scopes for apps that don't require legitimate use of the associated data.
• Onlypublic or custom appsare granted access scopes. Legacy app types, such as private or unpublished, won't be granted new access scopes.